4 ms·

How did you do that, what was the signal you disabled?

anonymousiam 6y ago
I somehow obtained an "ON TV" box. (From a friend of a friend who cancelled and never returned it.) I took a look at the innards and most of it looked a lot like a TV (RF front end, video demodulator, RF remodulator), Attached to the top (steel) cover was a module that was completely covered in blue potting material. I already knew about the scrambling techniques being used. (Sine wave mixed with video, but out of phase with horizontal sync pedestal. Sound encoded on narrow-band FM similar to SCA.) The blue module had only a few connections (from memory): 1) +12VDC and ground 2) Video input/output (via coax) from video demodulator. 3) Yellow wire which when driven with +12VDC, enabled FM demod of hidden sound channel. With nothing to lose, I took a blowtorch to the potted module. After about half an hour I had removed all of the potting (and many of the components). There was a large (40-pin) ASIC, a 14-pin (74xx TTL) chip, a few other chips, a row of drilled holes (24?) that coded the unique serial number of the box and fed it to the ASIC, and a one-transistor class-A inverting video amplifier/filter/mixer. The video amp had a bias input from the TTL chip (probably a 7400 configured as a S/R flip-flop). The ASIC had outputs to the yellow wire (sound) and to the 7400. It would receive coded instructions (sent to all boxes during the horizontal blanking interval) via the video input, but would only act on the "enable" or "disable" messages targeted to its serial number. Enable would set the flip-flop and disable would clear it. The bias from the 7400 flip-flop to the transistor came from pin 8 (NAND output). I deduced that the (destroyed) transistor had been NPN so I put in a 2N2222. I deduced the needed bias resistors and a DC-block capacitor and installed those too. I saw that when the NAND output was "low", it would bias the transistor to remove the sine wave from the video (by mixing it with an out-of-phase version provided by the ASIC). I was happy to find that my deductions were correct and that the (mostly destroyed) blue module actually worked well enough to decode the encrypted signals. I kept that box for myself and used it for years. When friends learned what I had done, they all wanted me to do the same thing to their boxes. I carefully measured the dimensions of blue module and the location of the 7400. By drilling into the lower part of the chip and shorting pin 7 (ground) to pin 8 (/enable) with a small blob of solder, the video decode would be enabled. Enabling sound was just a matter of cutting the yellow wire and connecting it to +12VDC. I got it all right on the first try and enabled many boxes for friends and acquaintances. It was my first real reverse-engineering/hardware hacking puzzle and I had a lot of fun doing it.
- anonymousiam 6y ago
  A few years later I came across a "SelecTV" box (a competing over-the-air scrambled subscription TV service). Their box was more advanced. It had the same basic sine-wave/SCA scrambling, but they had added an additional scrambling feature that would periodically invert, or not invert the video. It also had a set of four hex thumbwheel encoders on the front panel. (Subscribers would be given their unique enable code each month after they had paid.) By this time I had my own oscilloscope and lots of computer components. I built a circuit that would decode the (22-bit) data stream (coded in the same place that now includes Closed Caption data), and fed a magnitude comparator circuit fed with 3-position toggle switches (one/zero/don't care). I could hone in on the needed enable code for the invert/normal video signal in just a few minutes. SelecTV stayed in business for a few years beyond after ON TV went bankrupt.
- retSava 6y ago
  Ha! Thanks, interesting read, and amazing memory :). Reminds me of being a kid when we got a de-scrambler by my uncle, who worked as an engineer at Ericsson. It consisted of two large metallic cylinders (coffee containers really) in series, with what I assume is a turnpot or turncap in between them. Tuning was done by adjusting that turnpot, until the horizontal noise and rolling was removed. And that's the story of how we got TV1000.

I somehow obtained an "ON TV" box. (From a friend of a friend who cancelled and never returned it.) I took a look at the innards and most of it looked a lot like a TV (RF front end, video demodulator, RF remodulator), Attached to the top (steel) cover was a module that was completely covered in blue potting material. I already knew about the scrambling techniques being used. (Sine wave mixed with video, but out of phase with horizontal sync pedestal. Sound encoded on narrow-band FM similar to SCA.) The blue module had only a few connections (from memory): 1) +12VDC and ground 2) Video input/output (via coax) from video demodulator. 3) Yellow wire which when driven with +12VDC, enabled FM demod of hidden sound channel. With nothing to lose, I took a blowtorch to the potted module. After about half an hour I had removed all of the potting (and many of the components). There was a large (40-pin) ASIC, a 14-pin (74xx TTL) chip, a few other chips, a row of drilled holes (24?) that coded the unique serial number of the box and fed it to the ASIC, and a one-transistor class-A inverting video amplifier/filter/mixer. The video amp had a bias input from the TTL chip (probably a 7400 configured as a S/R flip-flop). The ASIC had outputs to the yellow wire (sound) and to the 7400. It would receive coded instructions (sent to all boxes during the horizontal blanking interval) via the video input, but would only act on the "enable" or "disable" messages targeted to its serial number. Enable would set the flip-flop and disable would clear it. The bias from the 7400 flip-flop to the transistor came from pin 8 (NAND output). I deduced that the (destroyed) transistor had been NPN so I put in a 2N2222. I deduced the needed bias resistors and a DC-block capacitor and installed those too. I saw that when the NAND output was "low", it would bias the transistor to remove the sine wave from the video (by mixing it with an out-of-phase version provided by the ASIC). I was happy to find that my deductions were correct and that the (mostly destroyed) blue module actually worked well enough to decode the encrypted signals. I kept that box for myself and used it for years. When friends learned what I had done, they all wanted me to do the same thing to their boxes. I carefully measured the dimensions of blue module and the location of the 7400. By drilling into the lower part of the chip and shorting pin 7 (ground) to pin 8 (/enable) with a small blob of solder, the video decode would be enabled. Enabling sound was just a matter of cutting the yellow wire and connecting it to +12VDC. I got it all right on the first try and enabled many boxes for friends and acquaintances. It was my first real reverse-engineering/hardware hacking puzzle and I had a lot of fun doing it.

anonymousiam 6y ago
A few years later I came across a "SelecTV" box (a competing over-the-air scrambled subscription TV service). Their box was more advanced. It had the same basic sine-wave/SCA scrambling, but they had added an additional scrambling feature that would periodically invert, or not invert the video. It also had a set of four hex thumbwheel encoders on the front panel. (Subscribers would be given their unique enable code each month after they had paid.) By this time I had my own oscilloscope and lots of computer components. I built a circuit that would decode the (22-bit) data stream (coded in the same place that now includes Closed Caption data), and fed a magnitude comparator circuit fed with 3-position toggle switches (one/zero/don't care). I could hone in on the needed enable code for the invert/normal video signal in just a few minutes. SelecTV stayed in business for a few years beyond after ON TV went bankrupt.
retSava 6y ago
Ha! Thanks, interesting read, and amazing memory :). Reminds me of being a kid when we got a de-scrambler by my uncle, who worked as an engineer at Ericsson. It consisted of two large metallic cylinders (coffee containers really) in series, with what I assume is a turnpot or turncap in between them. Tuning was done by adjusting that turnpot, until the horizontal noise and rolling was removed. And that's the story of how we got TV1000.